What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-07-07 compared with 2023-04-07 · 52 added, 1 removed, 2 unchanged (96% of the section changed)

We operate in a rapidly changing environment that involves certain risks and uncertainties, some of which are beyond our control.

In addition to the information provided in this report, please refer to Part I, Item 1A.

In addition to the updated risk factors provided below, please refer to Part I, Item 1A.

Risk Factors in our 2022 Annual Report for a more complete discussion regarding certain factors that could materially affect our business, financial condition or future results.

If our products contain software defects or security flaws, it could harm our revenues by causing us to lose customers and could increase our liabilities by exposing us to costly governmental investigations or litigation.

For example, the exploitation of the zero-day MOVEit Vulnerability in May 2023 has resulted in government inquiries, a formal law enforcement investigation, and private litigation.

Our products, despite extensive testing and quality control, may contain defects, vulnerabilities or security flaws.

In the ordinary course of business, we may need to issue corrective releases of our software products to fix any defects, vulnerabilities, or security flaws.

Depending upon the severity of any such matters, the detection and correction of such matters can be time consuming and costly.

If any such issues are exploited by malicious threat actors, we could experience, among other things, material adverse impact to our revenues due to loss of customers and increased liabilities due to costly governmental investigations or litigation.

In addition, any such matters could affect the ability of our products to work with hardware or other software products, delay the development or release of new products or new versions of products (due to a reallocation of our internal resources), and/or adversely affect market acceptance of our products, all of which could have a material adverse effect on our overall performance.

On the evening of May 28, 2023 (Eastern Time), our MOVEit technical support team received an initial customer support call indicating unusual activity within their MOVEit Transfer instance.

An investigative team was mobilized and, on May 30, 2023, the investigative team discovered a zero-day vulnerability in MOVEit Transfer (including our cloud-hosted versions of MOVEit Transfer, known as MOVEit Cloud).

The investigative team determined that the zero-day vulnerability (the “MOVEit Vulnerability”) could provide for unauthorized escalated privileges and access to the customer’s underlying environment in both MOVEit Transfer (the on-premise version) and MOVEit Cloud (a cloud-hosted version of MOVEit Transfer that we deploy in both (i) a public cloud format, as well as (ii) for a small group of customers, in a customer-dedicated cloud instance which is managed separately from the public-cloud).

We promptly took down MOVEit Cloud for further investigation and notified all then-known MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions.

In parallel, our team developed a patch for all supported versions of MOVEit Transfer and MOVEit Cloud, which was released on May 31, 2023 and allowed for the restoration of MOVEit Cloud the same day.

MOVEit Transfer is a secure file-transfer software that is installed by customers on-premise and does not have any on-going telemetry after installation that allows us to track, among other things, a customer’s product usage, deployed version, file transfer activity (including any data that is transferred by or stored within the customer’s MOVEit Transfer instance), or whether the customer has applied any security patches or bug fixes to their MOVEit Transfer instance.

However, certain MOVEit Transfer customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to their environments and portions of their sensitive customer data.

Furthermore, while we continue to investigate this vulnerability in MOVEit Cloud, we currently have not seen any evidence that sensitive customer data has been exfiltrated from the public MOVEit Cloud instances.

For a small group of customers, we provide a dedicated MOVEit Cloud instance which is hosted, for each such customer, separate and apart from the public instances of our MOVEit Cloud platform.

Two of our dedicated MOVEit Cloud customers have reported that malicious threat actors have exploited the MOVEit Vulnerability to obtain access to its environment.

As of the date of the filing of this report on Form 10-Q, one such customer has confirmed that no sensitive data was compromised and another has not revealed the nature of the data that may have been accessed.

As of the date of the filing of this report on Form 10-Q, these events have led to several domestic and foreign government inquiries, one formal investigation from a law enforcement agency, and private litigation, all of which could have adverse impacts on our business and operations and the results thereof.

More specifically, as of the date of the filing of this report on Form 10-Q, (i) four customers that claim to have been impacted by the MOVEit Vulnerability have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability, and (ii) there have been eleven class action lawsuits filed by

individuals who claim to have been impacted by exfiltration of data from the environments of our MOVEit Transfer customers.

We have also been cooperating with inquiries from several domestic and foreign law enforcement agencies and data privacy regulators, as well as one formal investigation from a law enforcement agency.

Such claims and investigations may have an adverse effect on how we operate our business and our results of operations, and in the future, we may be subject to additional governmental or regulatory investigations, as well as additional litigation or indemnification claims.

Following the discovery of the MOVEit Vulnerability and the various remedial actions described here, we have discovered and patched additional vulnerabilities within the MOVEit Transfer and MOVEit Cloud platforms.

While we are not aware of any evidence that these additional vulnerabilities were exploited by malicious threat actors prior to creating patches to address them and making those patches available to our MOVEit Transfer customers and applying those patches to the MOVEit Cloud environments (both the public and dedicated cloud instances) we cannot guarantee that we have or will uncover and/or address all vulnerabilities within the MOVEit platform or any of our other products prior to exploitation.

Our financial liability arising from any of the foregoing will depend on many factors, including the extent to which governmental entities investigate the matter and limitations contained within our customer contracts;

therefore, we are unable at this time to estimate the quantitative impact of any such liability with any reasonable degree of certainty.

As the investigation remains ongoing, we will continue to assess the potential impact of the MOVEit Vulnerability on our business, operations, and financial results.

Our customers and partners may seek refunds, delay implementation timelines, delay payment, fail to pay us in accordance with the terms of their agreements, or terminate use of our products, all of which can have an adverse affect on us.

If customers or partners seek refunds, delay implementation of our products, delay payment, fail to pay us under the terms of our agreements, or terminate use of our products, we may be adversely affected both from the inability to collect amounts due and the cost of enforcing the terms of our contracts (including litigation related thereto).

For example, as of the date of the filing of this report on Form 10-Q, four customers that claim to have been impacted by the MOVEit Vulnerability have indicated that they intend to seek indemnification from us related to the MOVEit Vulnerability and it is possible that, in connection therewith, they may delay payment under the terms of their contracts.

Other MOVEit Transfer and MOVEit Cloud customers have sought refunds or delayed implementation timelines.

As the scope of the impact of the MOVEit Vulnerability becomes more clear, additional customers may attempt to seek refunds, delay product implementation, withhold payments, or cease using the MOVEit product line entirely.

In addition, in the ordinary course of business, some of our customers and partners may seek bankruptcy protection or other similar relief and fail to pay amounts due to us, or pay those amounts more slowly, either of which could adversely affect our operating results, financial position and cash flow.

Our business could be damaged, and we could be subject to liability, in the event of any unauthorized access to our data or our customers’ data, including through privacy and data security breaches, such as or in addition to the MOVEit Vulnerability.

The use of certain of our products, including MOVEit Cloud, involves the transmission or storage of third-party data in our environment, some of which may be considered personally identifiable, confidential, or sensitive.

In the ordinary course of business, we face security threats from malicious threat actors that could obtain unauthorized access to our systems, infrastructure, products, and networks.

We anticipate that these threats will continue to grow in scope and complexity over time.

For example, once we discovered the MOVEit Vulnerability on May 30, 2023, we (i) promptly took down MOVEit Cloud for investigation, and (ii) notified all then-known MOVEit Transfer and MOVEit Cloud customers in order to apprise them of the MOVEit Vulnerability and alert them to immediate remedial actions.

In parallel, the MOVEit engineering team worked to develop a patch for all supported versions of MOVEit Transfer (and MOVEit Cloud), which was released on May 31, 2023 and allowed for the restoration of MOVEit Cloud that same day.

While we believe that our actions have, and will continue to, reduce the likelihood of similar vulnerabilities occurring in the future in our MOVEit product line, malicious threat actors might use techniques to exploit other zero-day vulnerabilities or use other means that we are unable to defend against, in order to compromise and infiltrate our systems, infrastructure, networks, and products, including, but not limited to, MOVEit or other products.

In addition, MOVEit Transfer is a secure file-transfer software that is installed by customers on-premise and does not have any on-going telemetry after installation that allows us to track, among other things, whether the customer has applied any security patches or bug fixes to their MOVEit Transfer instance.

While we devote a significant amount of resources to cyber security related matters in the operation of our business, we may fail to detect the existence of a breach and be unable to prevent unauthorized access to user and company content across our systems, infrastructure, products, and networks.

The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are often not recognized until launched against a target.

They may originate from less regulated or remote areas around the world, or from state-sponsored actors.

If our security measures are breached, we may suffer reputational damage, our products may be perceived as insecure, and we may lose existing customers, or fail to attract and retain new customers.

In addition to internal resources, we frequently rely on third parties when deploying our cybersecurity related infrastructure, and in doing so, may be exposed to security risks outside of our direct control.

In connection therewith, we rely on outside vendors and contractors to perform certain services necessary for the operation and testing of certain of our products, and they may fail to adequately secure our platform or discover vulnerabilities in our products.

While we have implemented security procedures and controls aimed at addressing these threats and patching vulnerabilities, our security measures could be compromised and our attempts to implement security measures and patch vulnerabilities could prove to be inadequate or could fail.

Any such failure could result in significant legal and financial exposure, increased costs to defend litigation, indemnity and other contractual obligations, government fines and penalties, damage to our reputation and our brand, and a loss of confidence in the security of our products and services that could potentially have an adverse effect on our business and results of operations.

In addition, our insurance coverage may not be adequate to cover all costs related to cybersecurity incidents or the exploitation of vulnerabilities as well as the disruptions resulting from such events.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors